Governance · Policy Engine

Fine-grained trust policies and runtime agent guardrails

Q: How are policies evaluated at runtime?

The Splyntra SDK includes a local, compiled in-memory policy evaluator that checks rules in less than 1 millisecond before any tool function executes. If an action violates a policy, it aborts the tool call and notifies Splyntra Core.

Q: Can policies be managed via CI/CD?

Yes. Splyntra policies can be managed as code in Git, tested using `splyntra policy test`, and deployed automatically via CI/CD pipelines.

Define declarative, enforceable boundaries for what autonomous agents are permitted to read, execute, and write. Splyntra evaluates RBAC, ABAC, and relationship-based (ReBAC) policies before tools are invoked.

Start free on this feature →View documentation Book technical demo

policy.yaml

yaml

version: "2026-01"
name: "customer-support-boundary"
target_agent: "support_agent_*"

rules:
  - action: "tool.execute"
    resource: "db.customer_records"
    condition:
      allowed_operations: ["SELECT"]
      max_rows: 10
      require_user_consent: true

  - action: "tool.execute"
    resource: "payment_gateway.*"
    effect: "DENY" # Support agents cannot trigger payments

< 1ms

Policy Evaluation

In-memory sub-millisecond guardrail checks.

RBAC/ABAC

Model Agnostic

Role, attribute, and relation-based access.

Inline Block

Enforcement

Prevents unauthorized tool execution.

GitOps Sync

Policy as Code

Version control policies via GitHub/GitLab.

Engineered for high-throughput autonomous agents

Every capability is built into the OpenTelemetry streaming pipeline with sub-millisecond ingestion overhead.

01Policy as Code

Declarative Policy-as-Code Engine

Write human-readable YAML/JSON policies defining allowable tool scopes, rate limits, spending boundaries, and data access tiers.

✓Sync policies directly from your Git repository (GitOps)
✓Validate policy syntax and test against historical traces before publishing
✓Automatic audit record generated whenever a policy is modified or evaluated

02Granular Access

Attribute & Relationship-Based Access (ABAC/ReBAC)

Grant agents dynamic permissions based on current user context, organization tier, data sensitivity labels, and runtime environment.

✓Scope agent permissions to specific tenant boundaries (multi-tenancy)
✓Restrict tool calls to approved external IP and domain allowlists
✓Time-bound just-in-time (JIT) credential elevation for specialized tasks

03Dry Run

Simulation & Dry-Run Mode

Evaluate proposed policy changes against production traces without blocking actual traffic to test for unexpected breakages.

✓Shadow-evaluate new security rules against real agent traffic
✓Detailed impact reports on how many tool calls would have been blocked
✓Zero false-positive confidence before switching to active enforcement

Frequently Asked Questions

How are policies evaluated at runtime?▼

The Splyntra SDK includes a local, compiled in-memory policy evaluator that checks rules in less than 1 millisecond before any tool function executes. If an action violates a policy, it aborts the tool call and notifies Splyntra Core.

Can policies be managed via CI/CD?▼

Yes. Splyntra policies can be managed as code in Git, tested using `splyntra policy test`, and deployed automatically via CI/CD pipelines.

Related Platform Features & Guides

GovernanceAudit Ledger →GovernanceDelegation & Approvals →SecurityRisk Score & Security →

Ready to monitor and secure your AI agents?

Get started in under 3 minutes with zero credit card required. Free tier includes up to 5 projects and community telemetry.

Start Free on Cloud Request Custom Enterprise Demo